CVE-2026-11835 — Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Description (CNA)

Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1.

Affected (CNA)

Vendor / product	Versions
Caliptra / Core ROM	affected 2.1.0 through 2.1.1; unaffected 2.1.2

CWE

CWE-367, CWE-20

References

https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-49mm-5gq5-v97f

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.